The OTX pulse describes PEEP, a Chromium post-exploitation toolkit masquerading as a benign Smart Bookmarks extension for Chrome and Edge. The activity is not an initial-access wave by itself; it is a persistence and control layer that becomes dangerous after an adversary already has administrative access on an endpoint. The operator converts the browser into a resident remote access trojan, then uses the browser's trusted position to steal sessions, monitor user activity, and pivot into host-level execution.
The collective signal points to an intrusion chain focused on credential and session theft rather than smash-and-grab ransomware. A likely operator flow is: obtain admin rights through a separate intrusion, disable or bypass normal extension-store controls, install or side-load the Smart Bookmarks implant, forge Chromium extension integrity values so the extension appears legitimate, register a native messaging host to escape the browser sandbox, beacon outward at a steady interval, and then harvest cookies, tokens, saved credentials, and active sessions. The listed reference CVE-2026-20316 should be treated as an associated validation point until verified against authoritative vulnerability data, because the key risk in this pulse is extension trust abuse and native messaging, not a single patch event.
Threat Actor / Malware Profile
Adversary attribution is unknown. The malware family is PEEP. The operator is likely financially motivated or part of an access-broker pipeline because the toolkit is optimized for browser session theft, credential access, and durable covert control that can be resold or reused.
Distribution method: post-compromise manual or scripted installation of a Chromium extension branded as Smart Bookmarks. PEEP bypasses Web Store review by forging or manipulating Chromium extension integrity expectations and by using side-loading or enterprise-policy style installation paths available only after privilege escalation.
Payload behavior: browser session hijacking, cookie and token theft, surveillance of browser telemetry, collection of stored credentials, and use of native messaging to communicate with a local helper process capable of host commands. This makes the browser both the lure and the control channel.
C2 communication: the pulse reports beacons every 30 seconds. The truncated description indicates the channel begins over an unencrypted or weakly protected transport before potentially upgrading or proxying through browser-like traffic. SOC teams should expect periodic short connections from chrome.exe or msedge.exe, extension service workers, or a spawned native messaging host process.
Persistence mechanism: malicious extension presence in Chromium profile extension directories, extension preference or secure preference tampering, policy-based forced install artifacts, and native messaging host manifest registration under user or machine browser configuration locations. Because it rides the browser, it can survive casual malware cleanup if only executables are removed and the extension store state remains poisoned.
Anti-analysis techniques: benign extension branding, abuse of signed browser processes, integrity-value forgery, blending into ordinary HTTPS browsing, use of native messaging to keep suspicious logic out of obvious extension scripts, and execution only after admin prerequisites are met. Expect the actor to clean obvious installer artifacts while leaving profile-level extension residue.
IOC Analysis
The pulse contains one CVE reference and seven FileHash-SHA256 indicators. There are no IPs, domains, or URLs in the supplied indicator sample, which means hash blocking alone is insufficient. The SHA256 values should be loaded into EDR block lists, malware detonation queues, and retro-hunts, but defenders should assume sample repacking is trivial for an extension-based implant.
Operationalize the indicators by type. FileHash-SHA256: block execution and file creation in EDR, search historical process, file, and browser extension telemetry, and submit unknown matches to sandboxing. CVE: treat CVE-2026-20316 as a validation task; confirm vendor advisory status, affected Chromium builds, and whether extension integrity checks are actually enforceable in your managed browser baseline. Domains and IPs: none were provided, so build detections around behavior: 30-second periodicity, chrome or edge network sessions without user browsing context, native messaging host registration, and extension preference changes.
Tooling that helps decode or pivot on these indicators includes EDR retro-hunt, Sigma-capable SIEM pipelines, Microsoft Sentinel or Defender advanced hunting, VirusTotal or MalwareBazaar-style hash enrichment, Chromium extension ID extraction from profile preferences, YARA for unpacked extension scripts, and TLS or JA3/JA4 analytics where network visibility exists. For browser artifacts, parse Preferences, Secure Preferences, Extensions directories, extension manifests, and NativeMessagingHosts registry or policy locations.
Detection Engineering
---
title: PEEP Chromium Extension Side-Load or Forced Install
id: 9f2a1e10-6b0d-4f3c-9f8d-peep0000001
status: experimental
description: Detects Chrome or Edge launched with extension loading flags or command lines consistent with PEEP Smart Bookmarks post-exploitation installation.
author: Security Arsenal
references:
- https://socradar.io/blog/peep-browser-rat-chrome-extension
date: 2026/09/07
modified: 2026/09/07
tags:
- attack.persistence
- attack.t1176
- attack.t1554
logsource:
category: process_creation
product: windows
detection:
sel_browser:
Image|endswith:
- chrome.exe
- msedge.exe
sel_flags:
CommandLine|contains:
- --load-extension
- --disable-extensions-except
- --install-extension
- Smart Bookmarks
- native messaging
condition: sel_browser and sel_flags
falsepositives:
- Developer browser debugging
- Managed extension deployment tools
level: high
---
title: Chromium Native Messaging Host Registration Anomaly
id: 9f2a1e10-6b0d-4f3c-9f8d-peep0000002
status: experimental
description: Detects creation or modification of Chromium native messaging host configuration that can bridge a malicious extension to host-level execution.
author: Security Arsenal
references:
- https://socradar.io/blog/peep-browser-rat-chrome-extension
date: 2026/09/07
modified: 2026/09/07
tags:
- attack.persistence
- attack.execution
- attack.t1176
- attack.t1059
logsource:
category: registry_event
product: windows
detection:
sel_nm:
TargetObject|contains:
- NativeMessagingHosts
- Google\Chrome\NativeMessagingHosts
- Microsoft\Edge\NativeMessagingHosts
sel_not_policy:
TargetObject|contains|not:
- \\Policies\\
condition: sel_nm and not sel_not_policy
falsepositives:
- Enterprise password manager or SSO browser integrations
level: medium
---
title: Browser Process Periodic Beacon Candidate
id: 9f2a1e10-6b0d-4f3c-9f8d-peep0000003
status: experimental
description: Network connection from Chrome or Edge with short periodic beacons and no obvious interactive browsing parent, consistent with PEEP 30-second callback behavior.
author: Security Arsenal
references:
- https://socradar.io/blog/peep-browser-rat-chrome-extension
date: 2026/09/07
modified: 2026/09/07
tags:
- attack.command_and_control
- attack.t1071
- attack.t1573
logsource:
category: network_connection
product: windows
detection:
sel_img:
Image|endswith:
- chrome.exe
- msedge.exe
sel_freq:
DestinationPort:
- 80
- 443
- 8080
condition: sel_img and sel_freq
falsepositives:
- Normal browser updates and telemetry
- Enterprise sync services
level: medium
let lookback = 7d;
let extProc = DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where FileName in~ ('chrome.exe','msedge.exe','msedgewebview2.exe')
| where ProcessCommandLine has_any ('--load-extension','--disable-extensions-except','--install-extension','Smart Bookmarks','native messaging')
| project DeviceId, DeviceName, Timestamp, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
let extNet = DeviceNetworkEvents
| where Timestamp >= ago(lookback)
| where InitiatingProcessFileName in~ ('chrome.exe','msedge.exe','msedgewebview2.exe')
| where RemotePort in (80,443,8080)
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP), First=min(Timestamp), Last=max(Timestamp) by DeviceId, InitiatingProcessFileName, bin(Timestamp, 30s)
| where Connections >= 1;
extProc
| join kind=leftouter extNet on DeviceId
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, RemoteIPs, Connections
| order by Timestamp desc
$ErrorActionPreference = 'SilentlyContinue'
$report = @()
$browserRoots = @(
(Join-Path $env:LOCALAPPDATA 'Google\Chrome\User Data'),
(Join-Path $env:LOCALAPPDATA 'Microsoft\Edge\User Data'),
(Join-Path $env:PROGRAMFILES 'Google\Chrome\Application'),
(Join-Path ${env:PROGRAMFILES(X86)} 'Microsoft\Edge\Application')
) | Where-Object { $_ -and (Test-Path $_) }
foreach ($root in $browserRoots) {
Get-ChildItem -Path $root -Recurse -Filter manifest.json -ErrorAction SilentlyContinue | ForEach-Object {
try {
$m = Get-Content $_.FullName -Raw | ConvertFrom-Json
$txt = Get-Content $_.FullName -Raw
if ($txt -match 'Smart Bookmarks|nativeMessaging|cookies|webRequest|tabs|<all_urls>') {
$report += [pscustomobject]@{Type='ExtensionManifest'; Path=$_.FullName; Name=$m.name; Version=$m.version; Permissions=($m.permissions -join ',')}
}
} catch {}
}
}
$nmKeys = @(
'HKCU:\Software\Google\Chrome\NativeMessagingHosts',
'HKLM:\Software\Google\Chrome\NativeMessagingHosts',
'HKCU:\Software\Microsoft\Edge\NativeMessagingHosts',
'HKLM:\Software\Microsoft\Edge\NativeMessagingHosts'
)
foreach ($k in $nmKeys) {
if (Test-Path $k) {
Get-ChildItem $k | ForEach-Object {
$report += [pscustomobject]@{Type='NativeMessagingHost'; Path=$_.PSPath; Name=$_.PSChildName; Version=''; Permissions=(Get-ItemProperty $_.PSPath).'(default)'}
}
}
}
Get-NetTCPConnection -State Established | Where-Object {
$_.OwningProcess -in @((Get-Process chrome,msedge,msedgewebview2 -ErrorAction SilentlyContinue).Id)
} | ForEach-Object {
$report += [pscustomobject]@{Type='BrowserConnection'; Path=($_.RemoteAddress + ':' + $_.RemotePort); Name=(Get-Process -Id $_.OwningProcess).ProcessName; Version=''; Permissions='LocalPort=' + $_.LocalPort}
}
$report | Sort-Object Type, Path | Format-List
Response Priorities
Immediate: block the seven SHA256 indicators in EDR and email/web gateways, isolate hosts showing chrome.exe or msedge.exe with extension-loading flags, capture browser profile directories before cleanup, and hunt for native messaging host registrations. Treat any browser process making fixed 30-second outbound connections without interactive tabs as suspicious until proven otherwise.
24h: because this is credential and session theft adjacent, force revocation of cookies, OAuth refresh tokens, SSO sessions, saved browser credentials, and remembered MFA sessions for impacted users. Reset passwords from a known-clean device, invalidate enterprise IdP sessions, review impossible travel and token replay, and check for mailbox rules, cloud app consent grants, and new device enrollments created after browser compromise.
1 week: harden the browser control plane. Disable developer mode and side-loading for standard users, enforce a managed extension allowlist, lock Secure Preferences with policy, alert on NativeMessagingHosts changes, require admin approval for extension installs, separate browser sync profiles for privileged users, and add EDR analytics for periodic browser beacons and extension permission sets such as cookies, tabs, webRequest, nativeMessaging, and all-url access.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.